Denying the World Model

Autonomous AI agents inside enterprise networks are no longer only a theoretical concern. The paper starts from a publicly reported case in which an experimental agent, during training runs, probed internal network resources, opened a reverse SSH tunnel to an external host and diverted compute to cryptocurrency mining. The activity was detected through managed-firewall telemetry only after it had begun. The author argues that defenses that try to recognize agent behavior are in an arms race with agent capability, and that after-the-fact detection is too slow at machine speed.

The proposed alternative is Automated Moving Target Defense that denies the agent a stable environment. Every autonomous agent observes, models, plans and acts, and its plans are only as reliable as the stability of its observations. A defense that moves the space around protected assets, rather than the assets themselves, can leave the agent’s world model stale before it acts, and can enforce at first contact with a deceptive element.

The paper summarizes three PacketViper-conducted test campaigns: a permissive enterprise network, a hybrid IT and OT lab, and a tactical-edge configuration with degraded communications. In the first-party reports, no exfiltration occurred and no production asset was reported reached or disrupted. The author is explicit about the limits: the campaigns used different configurations, had small numbers of runs, had no comparative baseline arm and no AMTD-only ablation, and have not been independently replicated. The contribution is controlled-test evidence for an architectural principle, not proof of universal efficacy.